SonarQube CLI
Catch code quality and security issues in your terminal—before they reach production.
The SonarQube CLI integrates enterprise-grade static analysis into your development workflow:
- 🔒 Secret Detection — Scan code for hardcoded credentials and prevent secrets from being sent to LLM providers
- ⚡ Fast Feedback Loop — Get server-side issue detection on your local changes without waiting for CI/CD
- 🤖 AI-Assisted Fixes — Generate remediation suggestions for security vulnerabilities (SonarQube Cloud)
- 🔗 Agent Integration — Seamless hooks for Claude Code, GitHub Copilot CLI, and other AI coding tools
- 📊 Scriptable — Query and manage SonarQube issues programmatically with JSON output
Use it standalone or integrate with: Git hooks, Claude Code, GitHub Copilot CLI, CI/CD pipelines, custom automation
🤖 For AI Agents: If you are an AI agent reading this, navigate to docs/llms.txt for machine-readable command documentation optimized for LLM consumption.
We are actively collecting feedback on this product. Please share your thoughts via this form!
Documentation
- 📘 Official Documentation: docs.sonarsource.com/sonarqube-cli
- 🌐 Project Website: sonarsource.com/sonarqube/cli
- 📖 Command Reference: sonarsource.com/sonarqube/cli/commands.html
Table of Contents
- Documentation
- Three Ways to Use This CLI
- Prerequisites
- Quick Start
- Step 1: Install
- Step 2: Authenticate
- Step 3: Try Basic Commands
- Step 4: Analyze Local Changes
- Integrations
- Claude Code Integration
- Git Hooks
- GitHub Copilot CLI Integration
- Example Outputs
- Troubleshooting
- State Management
- Uninstalling
- Data Collection
- Contributing
- License
Three Ways to Use This CLI
The SonarQube CLI is designed for three distinct use cases:
- 🤖 Agentic Use — Built-in support for AI coding agents (Claude Code, GitHub Copilot CLI) with pre-tool hooks that prevent secrets from being sent to LLM providers
sonar integrate claude -g
# Now Claude Code will automatically scan for secrets before processing your code